You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: report/src/sections/02-background.tex
+20-15Lines changed: 20 additions & 15 deletions
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,5 @@
1
-
2
1
\section{Background}\label{sec:background}
3
-
In this section, we provide the necessary background information on the Curdleproofs protocol~\cite{Curdleproofs}, the Whisk protocol~\cite{Whisk2024} and an overview of the notation used in the paper.
2
+
In this section, we provide the necessary background information on Ethereum and a specific attack it is vulnerable to, the Curdleproofs protocol~\cite{Curdleproofs}, and the Whisk protocol~\cite{Whisk2024}
4
3
5
4
The notation used throughout this paper can be seen in~\autoref{tab:notation}.
Since this work is based on the existing Curdleproofs protocol~\cite{Curdleproofs}, it inherits the same security assumptions.
58
57
Our work therefore runs as a public coin protocol in any cryptographic group where~\gls{ddh} is hard~\cite{10.1007/BFb0054851}.
58
+
\gls{ddh} is defined as follows.
59
59
60
60
\begin{definition}[DDH]
61
61
Given a finite, multiplicative cyclic group $\mathbb{G}$ of prime order $p$, the decisional Diffie-Hellman problem is defined as follows: Given $(g^a,g^b,g^c)\in\mathbb{G}$, where $g$ is a generator of $\mathbb{G}$ and $a,b,c\in\mathbb{Z}_p$, decide whether $c=ab$.
\paragraph*{\textbf{Ethereum Proof of Stake}}\label{par:background-ethereum}
67
65
Ethereum uses a proof-of-stake consensus mechanism, which allows users to validate transactions and create new blocks by staking their Ether (ETH) tokens.
68
66
The Proof-of stake protocol works in epochs of 32 slots, where each slot is 12 seconds long.
69
67
In each slot a proposer is chosen to propose a block thereby allowing the network to reach consensus on the state of the blockchain.
70
68
71
-
\paragraph*{\textbf{Proposer DoS attack}}\label{sec:background-proposer-DoS-attacks}
72
69
The proposer DoS attack is a type of attack that targets the block proposers making them unable to propose blocks.
73
-
An adversary can use the proposer DoS attack to prevent a proposer from receiving rewards, gotten from proposing a block, and increase their oen rewards~\cite{EthereumSSLE2024}.
70
+
An adversary can use the proposer DoS attack to prevent a proposer from receiving rewards, gotten from proposing a block, and increase their own rewards~\cite{EthereumSSLE2024}.
74
71
As a response to the proposer DoS attack, Ethereum has proposed a new protocol called Whisk~\cite{Whisk2024} as an attempt to mitigate the attack.
75
72
An attack on the Ethereum network that was discovered by Heimbach et al.~\cite{heimbach2024deanonymizingethereumvalidatorsp2p} is the deanonymization attack on validators.
76
-
In our preliminary work~\cite{ouroldpaper}, we have shown that the attack still possible to perform on the Ethereum network, and using the attack, a proposer~\gls{dos} can be performed.
73
+
In our preliminary work~\cite{ouroldpaper}, we have shown that the attack is still possible to perform on the Ethereum network, and using the attack, a proposer~\gls{dos} can be performed.
Whisk is a zero-knowledge Single Secret Leader Election (SSLE) system that uses a zero-knowledge argument called Curdleproofs~\cite{Curdleproofs} to verify the correctness of a shuffle without revealing the input or output~\cite{10.1145/3419614.3423258}.
81
-
Whisk works by selecting a list of proposers 16384 and shuffling them over 8192 slots (1 day).
82
-
Then 8192 proposers are selected from the shuffled list to propose blocks for the next 8192 slots while a new list is being shuffled.
77
+
Whisk works by selecting a list of 16,384 validator trackers and shuffles them over 8,192 slots ($\sim$1 day).
78
+
Then 8,192 proposers are selected from the shuffled list to propose blocks for the next 8,192 slots while a new list is being shuffled.
83
79
This way a new list of proposers is created every day.
84
-
After each shuffle Whisk uses a zero-knowledge proof to prove that the shuffle is correct.
80
+
After each shuffle, Whisk uses a zero-knowledge proof to prove that the shuffle is correct.
85
81
This is so that the proposer can prove that they are the correct proposer for the slot without revealing their identity, thereby mitigating the proposer~\gls{dos} attack because of the identity of the upcoming proposers being hidden now.
Then, using the Fiat-Shamir transformation, a challenge, $\mathbf{a}$, from public inputs is constructed, and a new commitment is made from that, $A=\sigma(\mathbf{a})\times\mathbf{g}$.
94
89
The~\gls{sameperm} proof now consists of convincing the verifier that the same permutation was used for constructing commitment $A$ and $M$.
95
90
To do this, the two commitments are used to construct a polynomial equation.
96
-
Then Neff's trick~\cite{10.1145/501983.502000}, which observes that two polynomials are equal iff.\ their roots are the same up to permutation.
91
+
Then Neff's trick~\cite{10.1145/501983.502000} is used, which observes that two polynomials are equal iff.\ their roots are the same up to permutation.
97
92
98
-
This is proven through a grand product argument.
93
+
To prove that, the protocol makes use of a grand product argument.
99
94
To prove that argument, Curdleproofs compiles it down to an~\gls{ipa} by expressing each multiplication of the grand product as its own equation.
100
95
101
96
Hence, the~\gls{sameperm} proof is done if the prover can prove the~\gls{ipa}.
Curdleproofs is a zero-knowledge proof system, which means that it allows a prover to convince a verifier that they know a secret without revealing the secret itself.
119
-
within the context of Ethereum it could be the ability to convince someone that a transaction is valid without revealing information about the transaction such as the value of it.
114
+
Within the context of Ethereum it could be the ability to convince someone that a transaction is valid without revealing information about the transaction such as the value of it.
115
+
In Whisk, it uses Curdleproofs to prove the validity of a shuffle.
120
116
121
117
\begin{definition}[Zero-Knowledge Argument of Knowledge]
122
118
An argument $(Setup, P, V)$ is a zero-knowledge argument of knowledge of a relation $\mathbb{R}$ if it satisfies completeness, knowledge-soundness and is honest-verifier zero-knowledge.
123
119
\end{definition}
124
120
121
+
Definitions for knowledge-soundness, completeness, and~\gls{hvzk} can be found in~\autoref{sec:appendix}.
A~\gls{ssle} is a protocol where a group of participants randomly elects only one leader from the group.
8
+
The identity of the leader is kept secret from all other participants so only the leader themselves know that they have been chosen.
9
+
The elected leader can then later publicly prove that they have been elected~\cite{10.1145/3419614.3423258}.
10
+
11
+
Leading research on~\gls{ssle} includes proposals for post-quantum secure protocols based on Learning With Errors and Ring Learning With Errors~\cite{cryptoeprint:2023/1241}.
12
+
This work also constructs a new concept called~\gls{rrc} for easier work with such protocols.
13
+
\gls{rrc} is based on the commit-and-shuffle approach also used in Whisk.
14
+
15
+
One of the use cases of~\gls{ssle} is to make~\gls{pos} blockchains more secure due to the added privacy that the proposer has.
16
+
17
+
One~\gls{pos} blockchain that uses an~\gls{ssle} is Polkadot which uses Safrole as their~\gls{ssle} protocol~\cite{safrole}.
18
+
Safrole is the production version of the research protocol Sassafras~\cite{sassafras}.
19
+
In this, validators each produce a number of tickets, some of which are winning, depending on some threshold.
20
+
A~\gls{zk-snark} is then used to prove that a ticket is winning, after which the winning tickets are published to the chain.
21
+
A randomization algorithm will then pick, from all the winning tickets, proposers for all the slots two epochs later.
The Håstad square shuffle~\cite{haastad2006square} is one of the proposed ways of shuffling, which could be integrated in a shuffling~\gls{ssle} such as Whisk.
28
+
The Håstad square shuffle is a shuffling algorithm that shuffles a vector with $n$ items with a shuffle size of $\sqrt {n}$.
29
+
The algorithm works by re-arranging the vector into a~$\sqrt{n}\times\sqrt{n}$ square matrix.
30
+
It then works in time steps, starting at 1.
31
+
For each odd step, each column and its elements are shuffled independently.
32
+
For each even step, each row and its elements are shuffled independently as well.
33
+
Håstad shows that at least three time steps are needed for the shuffle to be secure.
34
+
The Håstad shuffle is more rigid than the shuffling algorithm used in curdleproofs~\cite{cryptoeprint:2022/560} because of the fixed size of the shuffle being $\sqrt{n}$.
35
+
36
+
The Feistel shuffle~\cite{Feistle} is a previously used shuffle method in the Whisk protocol~\cite{Whisk2024}.
37
+
It takes $n$ number of validator trackers and arranges them in a $k\times k$ matrix.
38
+
Each round the $i$-th proposer selects the $i$-th row of the created matrix and shuffles it in the form $F(x,y)=(y,x+y^3\text{ mod }k)$.
39
+
The Feistel shuffle was later replaced by the shuffle proposed by Larsen et al.~\cite{cryptoeprint:2022/560}.
40
+
Ethereum mentioned the reason for this to be that the shuffle by Larsen et al.\ provides a simpler protocol~\cite{Whisk2024}.
A big inspiration for the Curdleproofs protocol is bulletproofs~\cite{bunz2018bulletproofs}.
44
+
Bulletproofs is a type of range proof that uses inner product arguments to prove that a committed value is within a certain range without revealing the value itself.
45
+
Bulletproofs is in itself not a zero-knowledge proof system, but with the help of Fiat Shamir~\cite{bunz2018bulletproofs} it can be used to create a zero-knowledge proof.
46
+
Bulletproofs also has had a few iterations and improvements to increase the speed and reduce the size of the proof since it was used in curdleproofs.
47
+
48
+
One of these is Bulletproofs+~\cite{chung2022bulletproofs+} which uses a weighted inner product argument instead of the standard inner product argument to achieve a better performance.
49
+
Bulletproofs+ is also a zero-knowledge proof by itself unlike the original bulletproofs.
50
+
Trying to modify Curdleproofs with the weighted inner product argument introduces complications that would need larger modifications and is therefore not suitable.
51
+
This can be seen in~\autoref{sec:curdleproofs-weighted-inner-product-argument-modification-attempt}
52
+
53
+
A third version of the Bulletproofs protocol is Bulletproofs++~\cite{eagen2024bulletproofs++} which uses a new type of argument called the norm argument to achieve a better performance.
54
+
This comes from the prover only needing to commit to a single vector, rather than two.
55
+
Therefore, with the two vectors, $x$ and $y$ of a standard~\gls{ipa}, they need to assume $x=y$ for their protocol to work.
56
+
Then, along with the norm being weighted, which raises the same complications as with Bulletproofs+, this makes it unsuitable for Curdleproofs.
0 commit comments